GHSL-2026-207: External pull request branches can execute commands and steal SonarCloud credentials in kpt

Published Oct 22, 2026

Updated

kpt's SonarCloud workflow interpolates attacker-controlled branch names into shell code, allowing external contributors to execute commands and capture the SonarCloud token.

Affected Software

1 affected component

Google kpt

Event History

Oct 22, 2026

Advisory Published

via GitHub Security Lab·12:00 AM

Data Sourced

via GitHub Security Lab·12:00 AM

Description

Frequently Asked Questions

Who can exploit this issue?

An external contributor who can open a pull request with an attacker-controlled branch name can exploit the vulnerable SonarCloud workflow.

What could an attacker obtain through successful exploitation?

The attacker can execute commands in the workflow context and capture the SonarCloud token exposed to that workflow.

GHSL-2026-207: External pull request branches can execute commands and steal SonarCloud credentials in kpt

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What could an attacker obtain through successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What could an attacker obtain through successful exploitation?